rest(public forms): POST /forms/:slug/submit answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet

Filing gate: ① product defect with reach measured. Class (a), security: disclosure to an anonymous caller. reach: the public door POST /api/v1/forms/:slug/submit, measured once with a wrong result on @objectstack/* 17.7.0 by the dev of objectstack-ai/hotcrm#2014 (report 6063106768), session session_012zh91QzFgePbkmuHnugLN3. The leg that elevates the app's web-intake hooks was a measurement prototype; it is not shipped.

Who acts on it: the objectstack triage seat routes it; the fix lands in packages/rest (the submit handler) or in the publicFormGrant read-back of plugin-security. Filed by the repo:hotcrm seat on the maintainer's ruling hotcrm-R74b item 4, letter B: 「平台先修，应用等待」. ⛔ Not a claim. hotcrm WAITs for it (hotcrm AGENTS.md §2); its web-intake fix is parked on this card.

What happens

The submit handler (packages/rest/src/rest-server.ts, :11211–:11224 on main 05c7c3fa3b) builds the anonymous context { publicFormGrant: { object }, permissions: ['guest_portal'], anonymous: true }, calls createData, and answers res.status(201).json(result). createData returns { record: result }, the record as stored after the insert pipeline (packages/metadata-protocol/src/protocol.ts, from :13609). The grant admits "create + the immediate read-back" for the target object (the comment at :11204–:11206).

The input side is filtered: only the form's declared section fields pass, and the system anchors are stripped (#3022, #6920). The output side is not: the read-back serves every stored field, including fields the caller never sent and fields that beforeInsert / afterInsert hooks computed. #21062 (PR #21101) put the masking rule's answer on this read-back; a field with no masking rule is served as stored.

That is harmless only while no hook on a form-target object reads existing data. The platform's own guidance points the other way: an app routes or de-duplicates web intake in a hook, and that hook needs elevation (runAs: 'system') to read the pool or the existing records. Then the anonymous 201 carries what the elevated read found.

Measured (hotcrm, 17.7.0)

With hotcrm's three web-intake hooks elevated (lead_auto_assign, case_auto_assign, lead_duplicate_check), an anonymous web-to-lead submit through the form door's context returned 201 with { record } carrying:

duplicate_status: 'suspected' and duplicate_of_type: 'crm_contact': the submitted email matched an existing contact;
that existing contact's id;
owner_id: a staff user's id, from the round-robin.

hotcrm's guest_portal set declares that a guest never reads existing CRM data (allowRead: false). Through this echo, anyone on the internet can test whether an email address is in the CRM and collect staff user ids. hotcrm therefore does NOT elevate these hooks: web leads and cases stay unrouted and un-deduplicated until this door is fixed.

Not measured: other apps; whether any shipped hook on a form-target object already derives a field from existing data without elevation.

Acceptance

The submit answer carries nothing the anonymous caller's grant may not read. For example: only the new record's id, or the record projected to the form's declared fields plus the id. Which shape is triage's call.
Fields written by hooks from existing data never reach the anonymous caller, elevated hooks included.
A pin: an elevated beforeInsert hook on a form-target object stamps a field from an existing record, and the 201 answer does not carry it.
The public form still answers 201 and the console's success screen still works.

security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 (closed): masking on this same read-back (position 1, PR fix(plugin-security)!: the record an anonymous public-form submit echoes back passes the result masker #21101). This card is the unmasked remainder.
design(v18): the complete guest model in one ADR — identity, doors, grants channel, organization, public-site binding, disclosure, rate limits, and each declared guest key's fate (ADR-0090 D9 enforce-or-remove) #22146 (open, target:v18): the complete guest model ADR. Its disclosure item names metadata (ADR-0106 D7), not this write echo; triage may fold this card into it.
runtime: any signed-in member can run a runAs: 'system' flow through POST /automation/:name/trigger — the door checks only anonymity, so an elevated sub-flow is an elevated door for everyone #22310 / [finding] runtime(security): two other doors that start a flow by name still let any signed-in member start a self-triggered system flow, after #22310 closes the trigger door #22407: the same app pattern (rule-9 elevation) meeting a door that was not built for it.

Duplicate check

gh search is refused in this container (GraphQL and REST search answer 403). So all objectstack issues were listed into a local index (/issues?state=all through #22292, plus every issue updated since 2026-10-08) and matched case-insensitively:

submit read-back: 11 hits; the only defect card is security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 (closed, masking only).
publicFormGrant: 7, all closed; finding: a section-less public form accepts ANY non-anchor field from an anonymous visitor (the write-side twin of #6601) #6920 is the input side, security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 the masking side.
forms/:slug/submit: 7, all closed; none is the read-back.
anonymous form hook: 24; design(v18): the complete guest model in one ADR — identity, doors, grants channel, organization, public-site binding, disclosure, rate limits, and each declared guest key's fate (ADR-0090 D9 enforce-or-remove) #22146 (guest model, metadata disclosure) and runtime: any signed-in member can run a runAs: 'system' flow through POST /automation/:name/trigger — the door checks only anonymity, so an elevated sub-flow is an elevated door for everyone #22310 are related, not this.
public form echo: 21, QA runs and CI cards only.

None is this defect.

Generated by Claude Code

Triage: first grade, `priority:p1` · `security` · `target:v18` · `domain:cli` · `area:access` · `bug` · `pm:queue`. Direction: the anonymous submit answer carries the new record's id and nothing stored

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-09T07:55Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Function level only from here on, on this card and in the PR.

Triage: lands in packages/rest/src/rest-server.ts (the public form submit handler's answer) ⇒ domain:cli. Rationale: packages/rest belongs to that lane.

Why p1 and security: a public, unauthenticated door returns fields the caller's grant may not read, including fields that hooks derive from existing records. It was measured on hotcrm, where it would let anyone probe CRM membership and collect staff ids. hotcrm holds back its own web-intake routing until this lands.
Why target:v18, and a separate card: this sits in the guest model's disclosure area (design(v18): the complete guest model in one ADR — identity, doors, grants channel, organization, public-site binding, disclosure, rate limits, and each declared guest key's fate (ADR-0090 D9 enforce-or-remove) #22146). design(v18): the complete guest model in one ADR — identity, doors, grants channel, organization, public-site binding, disclosure, rate limits, and each declared guest key's fate (ADR-0090 D9 enforce-or-remove) #22146 is in flight, so this card is not merged into it.
The shape (triage's call, as the card asks): the 201 answer carries the new record's id only.
- The caller already knows what it submitted, and a derived field must never reach it.
- Projecting to the form's declared fields would still serve a hook's rewrite of a declared field.
- If the Console's success screen measurably needs more, the claimant echoes the caller's own input for the declared fields, never the stored row. The PR says what was measured.
Narrowing: Clause-②: no (narrowing) on the door's answer. The changeset names the remedy for a host that read the echo: read the record through an authenticated read.
Pins:
- an elevated beforeInsert hook on a form-target object stamps a field from an existing record, and the 201 does not carry it, nor any stored field;
- control: the public form still answers 201, and the Console's success screen renders.

Claim: PM loop round 2
Session: session_01BmsuLyUeuG5CNpZFMH1jzS
Account: os-elon-musk (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-22437-public-form-submit-answers-id
Worktree: objectstack-issue-22437
Domain: domain:cli
Seat: domain:cli#1
File surface (read at origin/main bf492c854):

packages/rest/src/rest-server.ts: only the public form submit handler's answer (POST {basePath}/forms/:slug/submit, registered about :11107). Nothing else in the file.
Tests in packages/rest that pin that answer (public-form-routes*.test.ts, rest-write-response-internal-fields.tripwire.test.ts if it reads the echo), plus a new pin. The new pin: an elevated beforeInsert hook on a form-target object stamps a field from an existing record, and the 201 carries neither it nor any stored field.
The dogfood pins a repo-wide sweep finds asserting the stored-row echo (among them showcase-public-form*.dogfood.test.ts, public-form-read-back-masking.dogfood.test.ts and public-form-withdrawal*.dogfood.test.ts if they read it).
The hand-written docs pages that describe the submit answer (domain:devx's pages, declared on [PM seat] domain:devx @ objectstack — ⏳ vacant #6023 when the PR shows them).
.changeset/22437-*.md (@objectstack/rest patch).
⛔ Not plugin-security's publicFormGrant, ⛔ not packages/spec, ⛔ not objectui. A need for any of them stops the dev with a report.

Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: default (opus). dispatch-gates --tier prints "no path-derived mandate". The floor is raised to default because this card changes what an anonymous door discloses.
Clause-②: no (narrowing)
Responsibility: packages/rest/src/rest-server.ts's public form submit handler answers 201 with the stored row from createData, so an anonymous caller reads fields its grant may not read, hook-derived ones included | none: #21062 masks the read-back but serves every field without a masking rule | any anonymous internet caller on any deployment that publishes a form (measured once on 17.7.0 by objectstack-ai/hotcrm#2014's dev); used today by the Console's public form page
Thread-read: 6076863767
Serial constraints cleared:

PR feat(metadata-core,rest,runtime,plugin-email,spec)!: the /meta doors carry no organization; organization-admin metadata authoring closes (ADR-0131 D6, #15206 S3) #22447 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S3, domain:engine seat 2, draft) edits rest-server.ts only above :8710 (the /meta doors). It also edits public-form-withdrawal-walled, showcase-public-form-withdrawal-layers and showcase-public-form-withdrawal dogfood files, so if this card's sweep touches those three, the second to land merges main.
PR fix(rest): the API-description endpoints refuse an anonymous caller (#22430) #22446 (rest: the API-description endpoints (RestServer.registerOpenApiEndpoints) answer an anonymous caller with the whole object model; ADR-0056 D2 and ADR-0138 D2 require 401 #22430, this lane) holds only registerOpenApiEndpoints in rest-server.ts.
No other open PR touches the submit handler, the packages/rest public-form tests or the public-form dogfood files (REST file lists of all 17 open PRs, read in this act).
rest-server.ts is not a single-claim path.

Direction: triage 6076863767 (the card asks triage for the shape): the 201 carries the new record's id only. If the Console's success screen measurably needs more, echo the caller's own INPUT for the declared fields, never the stored row. Clause-② reading: the change narrows a door's answer, not a published acceptance set, so no contract-tier review is owed. If the dev measures a response shape for this door declared in packages/spec, that is a stop-and-report for the domain:spec lane. Disclosure: function level only on this card and in the PR, per triage.

Generated by Claude Code

os-dev-report
{
"issue": 22437,
"status": "done",
"branch": "claude/issue-22437-public-form-submit-answers-id",
"pr": "#22462",
"session": "session_01BmsuLyUeuG5CNpZFMH1jzS",
"premise_still_valid": true,
"summary": "The anonymous public-form submit (POST /api/v1/forms/:slug/submit, the submit handler in packages/rest/src/rest-server.ts) now answers 201 with { id } only: res.status(201).json({ id: result.id }), built from the createData result already in hand, with no second read, at the top-level key the console reads. Before the fix it relayed createData's whole { object, id, record } answer. Measured on a real boot, the record was the full stored row (13 keys), and with an elevated beforeInsert hook it carried the existing record's id the hook had found. Pins: a rest unit pin on the handler and the Hono wire, and a new dogfood pin with the elevated hook in two deployment shapes. Flipped pins: the #21062 masking pin now asserts the masked fields are absent at any depth; the showcase submit and #3022 anchor pins now read the landed row through a system read. Also changed: the tripwire disposition, the forms docs page, and a @objectstack/rest patch changeset. Ablation was red with the echo restored and green on the fix, twice. The whole dogfood suite, the rest suite, full lint and all 94 derived gates pass at 74a7828.",
"tests": "BEFORE-TABLE, measured before the fix: real bootStack (SecurityPlugin, ObjectQL, SQL driver, hook sandbox, REST, auth), at da159f7 plus pins only, rest-server.ts unchanged. The fixture is synthetic: a form-target object (declared subject and email, hook-stamped match_ref and match_kind, defaulted stage) and an existing-record object. Four boots: plain and an elevated beforeInsert hook (L2 body, runAs system, finds an existing record by the submitted email and stamps it), each with no guest set and with the guest set declared. All four answered 201, application/json, top-level keys [id, object, record]; record keys [created_at, created_by, email, id, match_kind, match_ref, organization_id, owner_id, owning_business_unit_id, stage, subject, updated_at, updated_by], equal to the stored row's keys. Hook boots: record.match_ref === the existing record's id (the derived value served to the anonymous caller). AFTER, at d7eb45d: all four answered 201 with top-level keys [id] and no record, and the stored row still holds the hook stamp. H1 confirmed at rest-server.ts registerFormEndpoints (the POST forms/:slug/submit registration, about :11108 on da159f7); the context and createData match the card. H2, objectui origin/main 47b1f0bb7, FormPage.tsx: submitPublic returns res.json(). The public default is thank-you and reads nothing off the answer. The redirect arm's token scope is payload, then unwrapTransportEnvelope(result).record, then readCreatedRecordId(result), which reads the TOP-LEVEL id after stripping a {success,data} envelope. This door answers a bare body, so the id is kept at top-level id and pinned on the wire. created-record is internal-only. objectui's own FormPage.redirect.test.tsx already stubs the public submit as answering no record. Redirect forms over undeclared fields: zero hits. The submitBehavior grep finds 3 example forms, all thank-you (the control); no kind redirect in examples, apps, packages/qa or test trees; no record-token in an example or public-form fixture. H3: no spec declaration of this door's answer. CreateDataResponseSchema is the protocol method's; the rest-route-ledger row is disposition public with no client or responseSchema; OpenAPI builtin paths invent none. packages/spec untouched. H4: the masking pin keeps its subject and asserts absence. H5: the tripwire declared the door protocol-ingress ('201s its result'); that reason became false, so it is now no-record-echo. H6: the elevated-hook pin runs through the real insert pipeline. RESULTS at 74a7828 (merges origin/main 2b61f2d, no conflict): rest test exit 0, 266 files, 4962 passed, 326 skipped. rest typecheck exit 0; the tsconfig.test.json program lists both rest test files (--listFilesOnly). dogfood typecheck exit 0, lists all 3 dogfood files. The WHOLE dogfood suite through the verify lock exited 0: 234 files passed, 1 skipped; 1840 tests passed, 9 skipped. pnpm lint (full eslint . --no-inline-config) exit 0. ABLATION (fix committed first): node scripts/ablation-replace.mjs anchor 'res.status(201).json({ id: result.id });' to 'res.status(201).json({ ...result, ablation22437: true });'. On disk: anchor 0, marker 1. Then rest build, and ablation-dist-preflight found the marker in dist/index.js and dist/index.cjs. Mutated: rest pin 2/2 failed; dogfood 6/8 failed (new pin x2, masking x2, showcase submit and anchors); the 2 passing read no answer. Restore: blob == HEAD 02f1be908368, git diff HEAD empty, rebuild, --absent: marker absent from 6 built files, tree clean; rest 2/2 and dogfood 8/8 passed. Run 2 on 74a7828, after widening absence to any depth, was the same: 2/2 and 6/8 red, now first failing on the per-field assertions, then 2/2 and 8/8 green. Direction: red without the fix (normal).",
"mcp_calls": "0",
"api_writes": "3 — each through the fleet-write relay, as POST /repos/objectstack-ai/objectstack/dispatches: (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft, #22462; body read back byte-identical, 12438 bytes); (2) assign → POST /repos//issues/22462/assignees [os-elon-musk] via scripts/pm/label-write.mjs (read back MATCHES); (3) comment → POST /repos//issues/22437/comments (this os-dev-report). Plus git push of the branch (not REST). No labels written: the PR publishes, so no skip-changeset.",
"gates": [
"node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0 :: ✓ check-adr-0087-registration: this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen).",
"node scripts/check-adr-0087-registration.mjs --self-test :: exit 0 :: ✓ check-adr-0087-registration --self-test: 441 assertions over real temp git repos (real scan()/assertInputs() path)",
"node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0 :: · no pull_request payload was available to read a declaration from",
"node scripts/check-changeset-no-major.mjs --self-test :: exit 0 :: ✓ check-changeset-no-major --self-test: 339 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in both directions + the #7005 diff scoping over real te",
"node scripts/check-ci-filter-parity.mjs :: exit 0 :: OK: all 20 build input(s) turbo.json declares outside the packages (itself, 2 globalDependencies, and every $TURBO_ROOT$ input of a build Build Core runs) and all 11 script(s) the build-core job's",
"node scripts/check-closing-keyword-parity.mjs :: exit 0 :: • packages/spec/src/migrations/registry.ts -- 2391810 bytes exceeds the sweep's 2097152-byte cutoff for UNREGISTERED files",
"node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0 :: ✓ check-closing-keyword-parity --self-test: 40 assertions, 5 mutations of the shipped parsers each driven to red.",
"node scripts/check-comment-mask-adoption.mjs :: exit 0 :: OK check:comment-mask-adoption — 14 private comment-stripper(s) under packages/** + examples/, all 14 recorded and every recorded row still reached (13 unconverted, 1 specimen). A new one reds here",
"node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0 :: PASS check-comment-mask-adoption --self-test (0 failure(s))",
"node scripts/check-comment-mask-corpus.mjs :: exit 0 :: ✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 8535 files, 0 disagree, 0 unparseable, 200.2s (comparator self-test: 26 cases pass).",
"node scripts/check-doc-frontmatter.mjs :: exit 0 :: ✓ check-doc-frontmatter: 2 content root(s) verified, each against its own floor — content/docs 411, content/blog 4.",
"node scripts/check-doc-frontmatter.mjs --self-test :: exit 0 :: ✓ check-doc-frontmatter --self-test: 99 assertions — the card's own description observed failing with the parser's message and the FILE line, every other violation kind observed firing, five REFUSALS ",
"node scripts/check-doc-route-spelling.mjs --advisory :: exit 0 :: ✓ route-spelling guard (advisory): population clean — every shape-matched literal spells its ledger row.",
"node scripts/check-doc-route-spelling.mjs --self-test :: exit 0 :: ✓ check-doc-route-spelling self-test: extraction tidy-up, the variant relation (plural + pinned lexicon, no prefix heuristic), walk wiring (releases/ and node_modules/ out, both roots in), ledger pars",
"node scripts/check-docs-section-name.mjs :: exit 0 :: so it is carried by --self-test rather than by this corpus.",
"node scripts/check-docs-section-name.mjs --self-test :: exit 0 :: ✓ check-docs-section-name self-test: 85 cases pass (real temp trees on disk; both historical misses reproduced as RED, both arms driven RED, the duplicate-key and syntax-error boundaries pinned, every",
"node scripts/check-dts-emitted.mjs --self-test :: exit 0 :: check-dts-emitted self-test: all assertions passed.",
"node scripts/check-empty-changeset.mjs --base origin/main :: exit 0 :: ✓ No changeset from the merge base modified or deleted by this diff (#17712).",
"node scripts/check-empty-changeset.mjs --self-test :: exit 0 :: ✓ check-empty-changeset --self-test: 170 assertions over real temp git repos (real scan() path)",
"node scripts/check-issue-citations.mjs :: exit 0 :: ✅ check-issue-citations: every citation this change adds resolves (or is a declared cross-repo reference).",
"node scripts/check-keyed-text-bounds.mjs :: exit 0 :: ⚠ The delta is information, not a verdict — this population grows AND shrinks for good reasons, and only the floors decide. Reproduce the record: see this file's header.",
"node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0 :: PASS check-keyed-text-bounds --self-test (0 failure(s))",
"node scripts/check-platform-object-tenancy-census.mjs :: exit 0 :: ✓ platform-object tenancy census matches the tree: 83 platform-namespace objects, 48 in the machinery's reach, 35 outside it, every exclusion explained by a declaration on its own schema.",
"node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0 :: ✓ check-platform-object-tenancy-census self-test: all checks pass (83 objects, 35 outside the machinery)",
"node scripts/check-plugin-teardown-shape.mjs :: exit 0 :: ✓ check:plugin-teardown-shape: 69 Plugin implementation(s) across 7959 source(s) under packages/; every teardown-shaped method (stop / shutdown / close / dispose) sits beside a real destroy() (0 kno",
"node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0 :: ✓ check-plugin-teardown-shape self-test: 48 cases pass (real pre-#10375 fixture reds, the repaired file and both delegating-alias directions stay green, every roster name reds, every excluded name sta",
"node scripts/check-registry-log-declared.mjs :: exit 0 :: examples/app-showcase — S1 constructs a SchemaRegistry in its tests",
"node scripts/check-registry-log-declared.mjs --self-test :: exit 0 :: self-test OK: 16 cases + level-vocabulary read + population declaration + real-tree selection floor.",
"node scripts/check-rest-log-spy-declared.mjs :: exit 0 :: OK: 30 of 272 test file(s) beside packages/rest/src/log.ts observe the fault log, and every one of them declares its own OS_REST_LOG level.",
"node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0 :: check-rest-log-spy-declared self-test reached its verdict: 23 case(s), 0 failure(s).",
"node scripts/check-section-landing-index.mjs :: exit 0 :: ✓ check-section-landing-index: 8 section index block(s) enumerate their meta.json pages, in order, both directions (ai, api, automation, data-modeling, kernel, permissions, plugins, ui); 27 landing pa",
"node scripts/check-section-landing-index.mjs --self-test :: exit 0 :: ✓ check-section-landing-index --self-test: 31 assertions over synthetic inputs and a temp fixture (real judge()/run() path); every limb -- both shapes in sync, missing page, undeclared row, wrong orde",
"node scripts/check-system-context-census.mjs :: exit 0 :: check-system-context-census: OK — 120 elevation read sites in 20 packages across 56 files, living in 102 symbol(s); the page cites 115 symbol(s) against 115 required, over 138 anchors and 7 file-level",
"node scripts/check-system-context-census.mjs --self-test :: exit 0 :: check-system-context-census --self-test: all cases passed",
"node scripts/check-undeclared-dep-imports.mjs :: exit 0 :: ⚠ The delta is information, not a verdict — the floors are ›= and cannot see an upward drift at all, which is why it is PRINTED. Reproduce the record: see this file's header.",
"node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0 :: PASS check-undeclared-dep-imports --self-test (0 failure(s))",
"node scripts/docs-audit/check-affected-docs.mjs :: exit 0 :: → the unreachable rows themselves: this command with --json",
"node scripts/docs-audit/check-drift-comment.mjs :: exit 0 :: ✓ check-drift-comment: 66 cases pass across 5 fixture diff(s).",
"node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0 :: ✓ self-test passed",
"node scripts/release-pending-publish.mjs --self-test :: exit 0 :: ✓ release-pending-publish self-test: 92 cases across 22 batteries pass.",
"pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0 :: #11673).",
"pnpm --filter @objectstack/lint run check:doc-security-posture :: exit 0 :: ✅ 28 ObjectSchema.create example(s) in 230 marked block(s) across 254 prose file(s) in 2 root(s) carry an os validate-clean security posture",
"pnpm --filter @objectstack/spec run check:docs :: exit 0 :: ✅ 225 generated files in sync with packages/spec",
"pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0 :: ✓ check:duration-unit-keys — 197 unit-declaring numeric key(s) across 2960 source file(s) all carry their unit in the key name (or in a sibling unit, or under a declared exemption: 6 declared durati",
"pnpm --filter @objectstack/spec run check:empty-state :: exit 0 :: ✓ all classified (2 closed, 2 open, 4 output, 9 scope)",
"pnpm --filter @objectstack/spec run check:liveness :: exit 0 :: (not a completeness claim about the 526 child key(s) under the declared blanket verdicts above — those are recorded, not classified.)",
"pnpm --filter @objectstack/spec run check:skill-examples :: exit 0 :: ✅ 262 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (re-run after full build; first run exit 3 PREREQUISITE NOT MET)",
"pnpm --filter @objectstack/spec run check:strictness-ledger :: exit 0 :: untriaged: 1203 object site(s) across 9 director(ies)",
"pnpm --filter @objectstack/spec run check:variant-docs :: exit 0 :: ✓ variant/doc gate: 18 discriminated union(s) — 8 governed (every variant mentioned in a bound doc), 10 exempt.",
"pnpm --filter @objectstack/spec run check:yaml-examples :: exit 0 :: ↳ 18 component node(s) also judged against their ComponentPropsMap props schema; 1 skipped (no row for the type — SDUI blocks and custom.* are an open namespace)",
"pnpm check:authz-resolver :: exit 0 :: ✓ check:authz-resolver: single shared authorization resolver intact; both entry points delegate.",
"pnpm check:changeset-gate-self-tests :: exit 0 :: ✓ check-changeset-no-major --self-test: 339 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in both directions + the #7005 diff scoping over real te",
"pnpm check:corpus-claim-drift :: exit 0 :: Ledger: 2 baselined file(s) in scripts/corpus-claim-drift-baseline.json.",
"pnpm check:cross-package-test-inputs :: exit 0 :: OK: 30 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob (6 of them on a split "test:repo" task); 13 walked root(s) judged, 3 on ACCEPTED_WALK_RADII; 2910 tes",
"pnpm check:dispatcher-error-vocabulary :: exit 0 :: [#15723] the ARGUMENT POSITION of new APIError( … ) and APIError.from( … ) IS now in this gate's population — the apierrorarg shape. APIError.from copies the record's code onto the body, so th",
"pnpm check:doc-anchors :: exit 0 :: ✅ check-doc-anchors: 472 internal #fragment link(s) across 417 source file(s) all resolve to a real heading",
"pnpm check:doc-authoring :: exit 0 :: ✓ doc authoring guard: sibling-package prose ids hold the baseline — 0 pinned site(s) across 0 file(s), 89730 string(s) read in 1284 parsed source(s) (seen floor 40000 strings / 600 sources), no growt",
"pnpm check:docs-audit-scope :: exit 0 :: ✓ scope injection is live: the workflow audits the list handed in as args.handwritten, and refuses an invocation that hands in no scope at all.",
"pnpm check:docs-redirects :: exit 0 :: check-docs-redirects: OK (apps/docs/redirects.mjs: 98 entries -- 95 page destination(s) resolved against content/docs, 3 wildcard destination(s) resolved to a directory, 0 outside the /docs route spac",
"pnpm check:docs-single-h1 :: exit 0 :: ✓ check-docs-single-h1: 411 page(s) under content/docs/ carry no body-level # heading (0 subtree(s) excluded, see --list).",
"pnpm check:docs-spec-enumerations :: exit 0 :: OK the hand-written spec enumerations agree with packages/spec/package.json -- 18 subpath(s) held ORDERED in content/docs/deployment/troubleshooting.mdx; 15 protocol namespace(s) [Data, System, Kernel",
"pnpm check:docs-transcript-drift :: exit 0 :: ✓ check-docs-transcript-drift: 4 declared transcript value(s) across 411 page(s) under content/docs/ equal what the registry derives today, and no undeclared block quotes one.",
"pnpm check:driver-memory-census :: exit 0 :: check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live, and every ruled file states "#6664 census: 2 ruled consumers". This gate polices the census, never investmen",
"pnpm check:dts-closure :: exit 0 :: check-dts-closure: 63 built package(s) swept - 161/161 declared declaration file(s) present across 63 package(s); 0 built package(s) declare no declaration entry point and owe none.",
"pnpm check:dual-build-cjs-loads :: exit 0 :: ✓ check:dual-build-cjs-loads — 107 published require entry point(s) across 66 package(s) load; 717 emitted CommonJS file(s) parse (re-run after full build; first run exit 3 PREREQUISITE NOT MET)",
"pnpm check:engine-double-contract :: exit 0 :: ⚠ The delta is information, not a verdict — this population grows AND shrinks for good reasons, and only the floors decide.",
"pnpm check:error-status-conformance :: exit 0 :: ✓ every derivable runtime status is documented, and every documented status is reachable.",
"pnpm check:gitlink-declared :: exit 0 :: check-gitlink-declared: OK (10447 index entries -- 0 gitlink(s) at mode 160000; no .gitmodules in the index, so nothing is declared; nothing to declare).",
"pnpm check:issue-citations :: exit 0 :: ✅ check-issue-citations --self-test: grammar narrowed, every spelling enumerated, qualifier a closed set of repositories, four 404 causes kept apart, both board strategies agree, diff scope red AND gr",
"pnpm check:lean-entry-closure :: exit 0 :: Admitted set held exactly (15 packages); 6 denied names absent.",
"pnpm check:logger-receiver-detach :: exit 0 :: control corpus fired on all five detach shapes in this same run, and stayed silent on the measured console and options-callback populations -- so the zero above is a reading.",
"pnpm check:nul-bytes :: exit 0 :: check-nul-bytes: OK (scanned 10438 text file(s) -- 10438 tracked, 0 untracked-not-ignored; skipped 9 binary; no raw ASCII control bytes).",
"pnpm check:objectql-double-limit :: exit 0 :: baseline key set verified against 2b61f2d: no files added.",
"pnpm check:objectui-changeset :: exit 0 :: ✓ objectui-range --self-test: all checks passed",
"pnpm check:org-identifier :: exit 0 :: check-org-identifier: OK (3261 author-facing source file(s), 18 session binding(s) resolved, no removed session.tenantId alias).",
"pnpm check:page-declaration-shape :: exit 0 :: blind spot: 1 computed carrier(s) no source scan can enumerate — examples/app-crm/objectstack.config.ts:86.",
"pnpm check:pm-changeset-deadline-census :: exit 0 :: ✓ changeset-deadline-census --self-test: all cases passed across 5 batteries (what counts as a named target, the controls that make a zero a reading, the verdict truth table including the inconclusive",
"pnpm check:published-files :: exit 0 :: ✓ check:published-files — 69 publishable package(s) of 80 workspace member(s) declare a files whitelist that covers every entry point plus CHANGELOG.md and admits no test, test-harness config or bui",
"pnpm check:published-readme-links :: exit 0 :: ✓ check:published-readme-links — 222 outbound link(s) across 101 published markdown file(s): 0 root-relative, 0 non-canonical origin(s), 27 docs-site page(s) resolved (0 via redirect), 1 anchor(s) ver",
"pnpm check:query-options-erasure :: exit 0 :: baseline key set verified against 2b61f2d: no files added.",
"pnpm check:react-page-adapter-contract :: exit 0 :: ✓ check-react-page-adapter-contract: 21 app-showcase page module(s) + 1 content/docs react-page sample(s) (from 394 doc file(s), 2003 fenced block(s)) — every adapter query option is $-prefixed, every",
"pnpm check:refd-timer-probe :: exit 0 :: 1 code site(s), all inside the approved module, which is present and still reads it.",
"pnpm check:role-word :: exit 0 :: Ledger: 44 baselined file(s) still carrying it (117 occurrence(s)) in scripts/role-word-baseline.json.",
"pnpm check:route-envelope :: exit 0 :: read/write discriminator: 11 file(s) skipped as fetch readers (77 zero-argument res.json() call(s), none swept in)",
"pnpm check:skill-identifier-liveness :: exit 0 :: check-skill-identifier-liveness OK — Leg 1: 457 citation(s) over 53 published file(s) checked against 123227 implementation word tokens (0 ledgered exemption(s)); Leg 2: 8 registered exhaustive sectio",
"pnpm check:slot-lookup :: exit 0 :: baseline key set verified against 2b61f2d: no files added.",
"pnpm check:sourcemap-no-sources-content :: exit 0 :: check-sourcemap-no-sources-content: 60 built package(s) swept - 528 map(s), none embed source text.",
"pnpm check:test-source-alias :: exit 0 :: check-test-source-alias OK — 73 packages with tests scanned; 60 registered as still resolving a workspace dep through dist/; 53 published subpath(s) resolved through every alias table.",
"pnpm check:tier-file-adoption :: exit 0 :: @objectstack/cli — 82 file(s); imports readTierMode, selectTierFiles from scripts/nightly-tiers.mjs (via packages/cli/vitest-tiers.ts)",
"pnpm check:type-check-coverage :: exit 0 :: ⚠ The delta is information, not a verdict — this population grows AND shrinks for good reasons, and only the floors decide.",
"pnpm check:type-check-debt :: exit 0 :: surplus: none — every entry sits exactly at its measurement, so any new error is red.",
"pnpm check:vendor-version-stamps :: exit 0 :: attestations. Re-verify one and you may restamp it; otherwise it stays a historical fact.",
"pnpm check:watch-hint-literal :: exit 0 :: ✓ check-watch-hint-literal: 72 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 48, ROOT_FILE_WATCH_HINTS 13, ROOT_WATCH_HINTS 3, DECLARED_WATCH_HINTS 8 -- every one an array of quoted",
"pnpm check:where-matcher :: exit 0 :: baseline key set verified against 2b61f2d: no files added."
],
"line_budget": "none set; vs merge base 2b61f2d: +479 / -53 over 8 files (changeset +21; content/docs/ui/forms.mdx +6/-10; public-form-read-back-masking.dogfood +31/-25; public-form-submit-answer.dogfood +202; showcase-public-form.dogfood +28/-10; rest public-form-submit-answer.test +166; rest-server.ts +18/-2; tripwire +7/-6)",
"files_changed": [
".changeset/22437-public-form-submit-answers-id.md",
"content/docs/ui/forms.mdx",
"packages/qa/dogfood/test/public-form-read-back-masking.dogfood.test.ts",
"packages/qa/dogfood/test/public-form-submit-answer.dogfood.test.ts",
"packages/qa/dogfood/test/showcase-public-form.dogfood.test.ts",
"packages/rest/src/public-form-submit-answer.test.ts",
"packages/rest/src/rest-server.ts",
"packages/rest/src/rest-write-response-internal-fields.tripwire.test.ts"
],
"deviations": [
"Clause-② conflict: Zone 1 quotes triage 'Clause-②: no (narrowing)'; the claim and the dispatch say bare 'Clause-②: no' and a patch changeset. I followed the claim in the PR body and the changeset. Under check-changeset-no-major and check-adr-0087-registration, '(narrowing)' is a breaking declaration that would need minor plus an ADR-0087 marker. Raised in open_questions.",
"Merged origin/main 2b61f2d (no rebase, no conflict) before opening the PR, per AGENTS.md multi-agent section 10, although neither fence PR had landed. #22446 and #22447 are still open and unmerged. A later main, 3ca71b6, merge-tree is clean and was not merged.",
"Tripwire edit: the claim's surface lists the file 'if it reads the echo'. It does not read the echo, but its protocol-ingress reason ('201s its result') states the answer and became false, so the disposition moved to no-record-echo. It is a test file in packages/rest.",
"A temporary measurement file, packages/qa/dogfood/test/zz-measure-22437.dogfood.test.ts, was used for the before and after tables and deleted. Never committed.",
"Two derived gates first refused with exit 3 because packages outside the dogfood build closure had no dist: check:skill-examples and check:dual-build-cjs-loads. After a full turbo build both exit 0, and --ran reports 94 run, 0 NOT-MEASURED.",
"Commit trailers and the PR footer follow AGENTS.md: the model-free Claude-Session and Co-authored-by pair, and the session-URL footer. The harness reminder's model-named trailer and its footer form were not used."
],
"open_questions": [
{
"question": "Clause-② spelling for this door's narrowing: triage named 'no (narrowing)', the claim and dispatch name bare 'no' with a patch changeset. Which one stands?",
"options": [
"A: keep bare 'Clause-②: no' + patch, the PR as opened (a response narrowing on a REST door, not an accept-set or spec surface)",
"B: switch to 'Clause-②: no (narrowing)', which under the gates means a minor bump plus an ADR-0087 disposition marker in the changeset and the PR body line changed by the seat (dev writes the body once)"
],
"recommendation": "A, because the changed thing is a response shape no spec or route-ledger row declares, and ADR-0087's conversion machinery has nothing to convert. The changeset still names the remedy triage asked for (an authenticated read). If the PM rules B, the seat edits the PR body line and the changeset."
}
],
"out_of_scope_findings": [
"carrier: whoever next edits packages/qa/dogfood/test/zero-set-masking.dogfood.test.ts (承接者:无) · noted, not filed — its header says the masker's zero-set reading 'is still reached on a real boot through the public form submit's echo, pinned by public-form-read-back-masking'; after this PR no door serves that read-back, so the sentence is false and that masker branch has no observable real-boot pin. Outside the claim's file surface; in the PR's Acceptance notes.",
"carrier: 承接者:无 · noted, not filed — the anonymous answer no longer carries droppedFields; measured: the console reads no droppedFields and this door never set X-ObjectStack-Dropped-Fields, so a form declaring a readonly field drops the visitor's value without a signal (as it already did for any reader of the header). In Acceptance notes.",
"carrier: domain:devx (承接者:无) · noted, not filed — content/docs/ui/forms.mdx 'Current renderer status (2026-08-11)' says the console does not substitute record tokens; objectui origin/main submitRedirect.ts substitutes them. Drift unrelated to this card, not edited.",
"carrier: PM / domain:devx seat · the claim says domain:devx docs pages are declared on #6023 when the PR shows them; PR #22462 shows content/docs/ui/forms.mdx. That declaration is outside this dev's write budget."
]
}

Review and correction: Clause-②: no (narrowing) (answering the dev's open question with B), plus one patch round · seat domain:cli#1 · session_01BmsuLyUeuG5CNpZFMH1jzS · 2026-10-09T10:51Z
Thread-read: 6079322133

The seat reviewed PR #22462 at 74a7828f5 and accepts the fix itself:

the submit handler answers res.status(201).json({ id: result.id }) from the createData result already in hand, with no second read;
the id stays at the top-level key the Console reads;
the write path is unchanged;
the docs page, the tripwire disposition and the masking pin (now absence at any depth) follow it.

The claim 6077827299 declared a bare Clause-②: no with a patch changeset, against triage's no (narrowing). That was the seat's error. The answer drops a field a host may have read, so it is a narrowing and BREAKING under AGENTS.md (Post-Task Checklist 3): minor, a BREAKING note, and an ADR-0087 disposition marker. This matches this ruling family's precedent (PR #22439) and the correction just made on #22430.

Done in this act:

The claim's line-initial key now reads Clause-②: no (narrowing).
The PR body line was changed by the seat.
The content/docs/ui/forms.mdx edit is declared on [PM seat] domain:devx @ objectstack — ⏳ vacant #6023.

No contract-tier review is owed: contract-review.md assigns that review by face, and the PR touches none of the three (no Clause-②: yes, no packages/spec, no governed text).

Patch round 1 (surface extension):

.changeset/22437-public-form-submit-answers-id.md: minor, a ! summary, Clause-②: no (narrowing), and the ADR-0087 marker. The disposition is the one the gate accepts for a removed response field; the gate prints the categories.
packages/qa/dogfood/test/zero-set-masking.dogfood.test.ts: its header sentence says the masker's zero-set reading "is still reached on a real boot through the public form submit's echo". This PR makes that false, so the sentence must say what is true now.

Generated by Claude Code

os-dev-report
{
"issue": 22437,
"status": "done",
"branch": "claude/issue-22437-public-form-submit-answers-id",
"pr": "#22462",
"session": "session_01BmsuLyUeuG5CNpZFMH1jzS",
"premise_still_valid": true,
"round": "patch round 1",
"head": "38e9287e3",
"summary": "Patch round 1 made one commit, 38e9287, on top of 74a7828. The changeset is now '@objectstack/rest': minor, with a 'fix(rest)!:' summary, 'Clause-②: no (narrowing)', a BREAKING note, and exactly one ADR-0087 marker: not-required (no-migration-prescription). The marker's reason, from this diff: the 201 answer drops object, record and droppedFields and keeps id; the door's answer has no spec declaration; no tombstone, nothing for migrate meta; the other categories are closed on facts. The gate accepts it, so no packages/spec ledger or tombstone was needed. The authenticated-read migration line is kept. The zero-set-masking dogfood header is rewritten, prose only. It now says the masker's zero-set reading reaches no caller through any door on a real boot: the grant's read-back is still masked inside the engine, but the submit answers the id alone. It names where the branch is still pinned: public-form-read-back-masking for the absence, and plugin-security's public-form-grant-masking.test.ts for the masker output, on a synthetic harness. merge-tree against main 3ca71b6 is clean, so main was not merged. No PR body PATCH; replacement text is in pr_body_replacements.",
"tests": "At 38e9287: node scripts/check-adr-0087-registration.mjs --base origin/main exit 0: '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition … [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'. node scripts/check-changeset-no-major.mjs --base origin/main exit 0, with no PR payload locally. The same gate with --event, fed the live PR #22462 payload, exit 0: 'this PR declares clause-② no (narrowing), and no package … is graded patch'. pnpm check:changeset-gate-self-tests exit 0 (170 + 441 + 339 assertions). pnpm check:doc-authoring exit 0. Full turbo build through the verify lock: 72/72 cached, exit 0. zero-set-masking.dogfood.test.ts through the verify lock exit 0, 1 file and 1 test passed. Re-derived gates with no paths: 94 commands, identical to 74a7828. All 94 exit 0, and --ran reports 94 run, 0 NOT-MEASURED. No source or test logic changed this round, so the round-0 rest suite, the whole dogfood suite and the ablation readings at 74a7828 stand.",
"mcp_calls": "0",
"api_writes": "1 — through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches): comment → POST /repos//issues/22437/comments (this round's os-dev-report; the role file makes the GitHub comment the report's authoritative copy). Plus git push of 38e9287 (not REST). No PR body PATCH, no label or assignee write.",
"gates": [
"node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0 :: ::notice file=.changeset/22437-public-form-submit-answers-id.md::ADR-0087 exemption (no-migration-prescription): A runtime response narrowing at one REST door, not a metadata chang",
"node scripts/check-adr-0087-registration.mjs --self-test :: exit 0 :: ✓ check-adr-0087-registration --self-test: 441 assertions over real temp git repos (real scan()/assertInputs() path)",
"node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0 :: · no pull_request payload was available to read a declaration from",
"node scripts/check-changeset-no-major.mjs --self-test :: exit 0 :: ✓ check-changeset-no-major --self-test: 339 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in both directions + the #7005 diff ",
"node scripts/check-ci-filter-parity.mjs :: exit 0 :: OK: all 20 build input(s) turbo.json declares outside the packages (itself, 2 globalDependencies, and every $TURBO_ROOT$ input of a build Build Core runs) and all 11 script(s) th",
"node scripts/check-closing-keyword-parity.mjs :: exit 0 :: • packages/spec/src/migrations/registry.ts -- 2391810 bytes exceeds the sweep's 2097152-byte cutoff for UNREGISTERED files",
"node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0 :: ✓ check-closing-keyword-parity --self-test: 40 assertions, 5 mutations of the shipped parsers each driven to red.",
"node scripts/check-comment-mask-adoption.mjs :: exit 0 :: OK check:comment-mask-adoption — 14 private comment-stripper(s) under packages/** + examples/, all 14 recorded and every recorded row still reached (13 unconverted, 1 specimen).",
"node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0 :: PASS check-comment-mask-adoption --self-test (0 failure(s))",
"node scripts/check-comment-mask-corpus.mjs :: exit 0 :: ✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 8535 files, 0 disagree, 0 unparseable, 145.7s (comparator self-test: 26 cases pass).",
"node scripts/check-doc-frontmatter.mjs :: exit 0 :: ✓ check-doc-frontmatter: 2 content root(s) verified, each against its own floor — content/docs 411, content/blog 4.",
"node scripts/check-doc-frontmatter.mjs --self-test :: exit 0 :: ✓ check-doc-frontmatter --self-test: 99 assertions — the card's own description observed failing with the parser's message and the FILE line, every other violation kind observed fi",
"node scripts/check-doc-route-spelling.mjs --advisory :: exit 0 :: ✓ route-spelling guard (advisory): population clean — every shape-matched literal spells its ledger row.",
"node scripts/check-doc-route-spelling.mjs --self-test :: exit 0 :: ✓ check-doc-route-spelling self-test: extraction tidy-up, the variant relation (plural + pinned lexicon, no prefix heuristic), walk wiring (releases/ and node_modules/ out, both ro",
"node scripts/check-docs-section-name.mjs :: exit 0 :: so it is carried by --self-test rather than by this corpus.",
"node scripts/check-docs-section-name.mjs --self-test :: exit 0 :: ✓ check-docs-section-name self-test: 85 cases pass (real temp trees on disk; both historical misses reproduced as RED, both arms driven RED, the duplicate-key and syntax-error boun",
"node scripts/check-dts-emitted.mjs --self-test :: exit 0 :: check-dts-emitted self-test: all assertions passed.",
"node scripts/check-empty-changeset.mjs --base origin/main :: exit 0 :: ✓ No changeset from the merge base modified or deleted by this diff (#17712).",
"node scripts/check-empty-changeset.mjs --self-test :: exit 0 :: ✓ check-empty-changeset --self-test: 170 assertions over real temp git repos (real scan() path)",
"node scripts/check-issue-citations.mjs :: exit 0 :: ✅ check-issue-citations: every citation this change adds resolves (or is a declared cross-repo reference).",
"node scripts/check-keyed-text-bounds.mjs :: exit 0 :: ⚠ The delta is information, not a verdict — this population grows AND shrinks for good reasons, and only the floors decide. Reproduce the record: see this file's header.",
"node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0 :: PASS check-keyed-text-bounds --self-test (0 failure(s))",
"node scripts/check-platform-object-tenancy-census.mjs :: exit 0 :: ✓ platform-object tenancy census matches the tree: 83 platform-namespace objects, 48 in the machinery's reach, 35 outside it, every exclusion explained by a declaration on its own ",
"node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0 :: ✓ check-platform-object-tenancy-census self-test: all checks pass (83 objects, 35 outside the machinery)",
"node scripts/check-plugin-teardown-shape.mjs :: exit 0 :: ✓ check:plugin-teardown-shape: 69 Plugin implementation(s) across 7959 source(s) under packages/; every teardown-shaped method (stop / shutdown / close / dispose) sits beside a r",
"node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0 :: ✓ check-plugin-teardown-shape self-test: 48 cases pass (real pre-#10375 fixture reds, the repaired file and both delegating-alias directions stay green, every roster name reds, eve",
"node scripts/check-registry-log-declared.mjs :: exit 0 :: examples/app-showcase — S1 constructs a SchemaRegistry in its tests",
"node scripts/check-registry-log-declared.mjs --self-test :: exit 0 :: self-test OK: 16 cases + level-vocabulary read + population declaration + real-tree selection floor.",
"node scripts/check-rest-log-spy-declared.mjs :: exit 0 :: OK: 30 of 272 test file(s) beside packages/rest/src/log.ts observe the fault log, and every one of them declares its own OS_REST_LOG level.",
"node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0 :: check-rest-log-spy-declared self-test reached its verdict: 23 case(s), 0 failure(s).",
"node scripts/check-section-landing-index.mjs :: exit 0 :: ✓ check-section-landing-index: 8 section index block(s) enumerate their meta.json pages, in order, both directions (ai, api, automation, data-modeling, kernel, permissions, plugins",
"node scripts/check-section-landing-index.mjs --self-test :: exit 0 :: ✓ check-section-landing-index --self-test: 31 assertions over synthetic inputs and a temp fixture (real judge()/run() path); every limb -- both shapes in sync, missing page, undecl",
"node scripts/check-system-context-census.mjs :: exit 0 :: check-system-context-census: OK — 120 elevation read sites in 20 packages across 56 files, living in 102 symbol(s); the page cites 115 symbol(s) against 115 required, over 138 anch",
"node scripts/check-system-context-census.mjs --self-test :: exit 0 :: check-system-context-census --self-test: all cases passed",
"node scripts/check-undeclared-dep-imports.mjs :: exit 0 :: ⚠ The delta is information, not a verdict — the floors are ›= and cannot see an upward drift at all, which is why it is PRINTED. Reproduce the record: see this file's header.",
"node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0 :: PASS check-undeclared-dep-imports --self-test (0 failure(s))",
"node scripts/docs-audit/check-affected-docs.mjs :: exit 0 :: → the unreachable rows themselves: this command with --json",
"node scripts/docs-audit/check-drift-comment.mjs :: exit 0 :: ✓ check-drift-comment: 66 cases pass across 5 fixture diff(s).",
"node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0 :: ✓ self-test passed",
"node scripts/release-pending-publish.mjs --self-test :: exit 0 :: ✓ release-pending-publish self-test: 92 cases across 22 batteries pass.",
"pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0 :: #11673).",
"pnpm --filter @objectstack/lint run check:doc-security-posture :: exit 0 :: ✅ 28 ObjectSchema.create example(s) in 230 marked block(s) across 254 prose file(s) in 2 root(s) carry an os validate-clean security posture",
"pnpm --filter @objectstack/spec run check:docs :: exit 0 :: ✅ 225 generated files in sync with packages/spec",
"pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0 :: ✓ check:duration-unit-keys — 197 unit-declaring numeric key(s) across 2960 source file(s) all carry their unit in the key name (or in a sibling unit, or under a declared exemptio",
"pnpm --filter @objectstack/spec run check:empty-state :: exit 0 :: ✓ all classified (2 closed, 2 open, 4 output, 9 scope)",
"pnpm --filter @objectstack/spec run check:liveness :: exit 0 :: (not a completeness claim about the 526 child key(s) under the declared blanket verdicts above — those are recorded, not classified.)",
"pnpm --filter @objectstack/spec run check:skill-examples :: exit 0 :: ✅ 262 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them",
"pnpm --filter @objectstack/spec run check:strictness-ledger :: exit 0 :: untriaged: 1203 object site(s) across 9 director(ies)",
"pnpm --filter @objectstack/spec run check:variant-docs :: exit 0 :: ✓ variant/doc gate: 18 discriminated union(s) — 8 governed (every variant mentioned in a bound doc), 10 exempt.",
"pnpm --filter @objectstack/spec run check:yaml-examples :: exit 0 :: ↳ 18 component node(s) also judged against their ComponentPropsMap props schema; 1 skipped (no row for the type — SDUI blocks and custom.* are an open namespace)",
"pnpm check:authz-resolver :: exit 0 :: ✓ check:authz-resolver: single shared authorization resolver intact; both entry points delegate.",
"pnpm check:changeset-gate-self-tests :: exit 0 :: ✓ check-changeset-no-major --self-test: 339 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in both directions + the #7005 diff ",
"pnpm check:corpus-claim-drift :: exit 0 :: Ledger: 2 baselined file(s) in scripts/corpus-claim-drift-baseline.json.",
"pnpm check:cross-package-test-inputs :: exit 0 :: OK: 30 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob (6 of them on a split "test:repo" task); 13 walked root(s) judged, 3 on ACCEPTED_",
"pnpm check:dispatcher-error-vocabulary :: exit 0 :: [#15723] the ARGUMENT POSITION of new APIError( … ) and APIError.from( … ) IS now in this gate's population — the apierrorarg shape. APIError.from copies the record's code ",
"pnpm check:doc-anchors :: exit 0 :: ✅ check-doc-anchors: 472 internal #fragment link(s) across 417 source file(s) all resolve to a real heading",
"pnpm check:doc-authoring :: exit 0 :: ✓ doc authoring guard: sibling-package prose ids hold the baseline — 0 pinned site(s) across 0 file(s), 89730 string(s) read in 1284 parsed source(s) (seen floor 40000 strings / 60",
"pnpm check:docs-audit-scope :: exit 0 :: ✓ scope injection is live: the workflow audits the list handed in as args.handwritten, and refuses an invocation that hands in no scope at all.",
"pnpm check:docs-redirects :: exit 0 :: check-docs-redirects: OK (apps/docs/redirects.mjs: 98 entries -- 95 page destination(s) resolved against content/docs, 3 wildcard destination(s) resolved to a directory, 0 outside ",
"pnpm check:docs-single-h1 :: exit 0 :: ✓ check-docs-single-h1: 411 page(s) under content/docs/ carry no body-level # heading (0 subtree(s) excluded, see --list).",
"pnpm check:docs-spec-enumerations :: exit 0 :: OK the hand-written spec enumerations agree with packages/spec/package.json -- 18 subpath(s) held ORDERED in content/docs/deployment/troubleshooting.mdx; 15 protocol namespace(s) [",
"pnpm check:docs-transcript-drift :: exit 0 :: ✓ check-docs-transcript-drift: 4 declared transcript value(s) across 411 page(s) under content/docs/ equal what the registry derives today, and no undeclared block quotes one.",
"pnpm check:driver-memory-census :: exit 0 :: check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live, and every ruled file states "#6664 census: 2 ruled consumers". This gate polices the cen",
"pnpm check:dts-closure :: exit 0 :: check-dts-closure: 72 built package(s) swept - 172/172 declared declaration file(s) present across 72 package(s); 0 built package(s) declare no declaration entry point and owe none",
"pnpm check:dual-build-cjs-loads :: exit 0 :: ⚠ The delta is information, not a verdict — this population grows AND shrinks for good reasons, and only the floors decide. Reproduce the record: see this file's header.",
"pnpm check:engine-double-contract :: exit 0 :: ⚠ The delta is information, not a verdict — this population grows AND shrinks for good reasons, and only the floors decide.",
"pnpm check:error-status-conformance :: exit 0 :: ✓ every derivable runtime status is documented, and every documented status is reachable.",
"pnpm check:gitlink-declared :: exit 0 :: check-gitlink-declared: OK (10447 index entries -- 0 gitlink(s) at mode 160000; no .gitmodules in the index, so nothing is declared; nothing to declare).",
"pnpm check:issue-citations :: exit 0 :: ✅ check-issue-citations --self-test: grammar narrowed, every spelling enumerated, qualifier a closed set of repositories, four 404 causes kept apart, both board strategies agree, d",
"pnpm check:lean-entry-closure :: exit 0 :: Admitted set held exactly (15 packages); 6 denied names absent.",
"pnpm check:logger-receiver-detach :: exit 0 :: control corpus fired on all five detach shapes in this same run, and stayed silent on the measured console and options-callback populations -- so the zero above is a reading.",
"pnpm check:nul-bytes :: exit 0 :: check-nul-bytes: OK (scanned 10438 text file(s) -- 10438 tracked, 0 untracked-not-ignored; skipped 9 binary; no raw ASCII control bytes).",
"pnpm check:objectql-double-limit :: exit 0 :: baseline key set verified against 2b61f2d: no files added.",
"pnpm check:objectui-changeset :: exit 0 :: ✓ objectui-range --self-test: all checks passed",
"pnpm check:org-identifier :: exit 0 :: check-org-identifier: OK (3261 author-facing source file(s), 18 session binding(s) resolved, no removed session.tenantId alias).",
"pnpm check:page-declaration-shape :: exit 0 :: blind spot: 1 computed carrier(s) no source scan can enumerate — examples/app-crm/objectstack.config.ts:86.",
"pnpm check:pm-changeset-deadline-census :: exit 0 :: ✓ changeset-deadline-census --self-test: all cases passed across 5 batteries (what counts as a named target, the controls that make a zero a reading, the verdict truth table includ",
"pnpm check:published-files :: exit 0 :: ✓ check:published-files — 69 publishable package(s) of 80 workspace member(s) declare a files whitelist that covers every entry point plus CHANGELOG.md and admits no test, test-h",
"pnpm check:published-readme-links :: exit 0 :: ✓ check:published-readme-links — 222 outbound link(s) across 101 published markdown file(s): 0 root-relative, 0 non-canonical origin(s), 27 docs-site page(s) resolved (0 via redire",
"pnpm check:query-options-erasure :: exit 0 :: baseline key set verified against 2b61f2d: no files added.",
"pnpm check:react-page-adapter-contract :: exit 0 :: ✓ check-react-page-adapter-contract: 21 app-showcase page module(s) + 1 content/docs react-page sample(s) (from 394 doc file(s), 2003 fenced block(s)) — every adapter query option ",
"pnpm check:refd-timer-probe :: exit 0 :: 1 code site(s), all inside the approved module, which is present and still reads it.",
"pnpm check:role-word :: exit 0 :: Ledger: 44 baselined file(s) still carrying it (117 occurrence(s)) in scripts/role-word-baseline.json.",
"pnpm check:route-envelope :: exit 0 :: read/write discriminator: 11 file(s) skipped as fetch readers (77 zero-argument res.json() call(s), none swept in)",
"pnpm check:skill-identifier-liveness :: exit 0 :: check-skill-identifier-liveness OK — Leg 1: 457 citation(s) over 53 published file(s) checked against 123227 implementation word tokens (0 ledgered exemption(s)); Leg 2: 8 register",
"pnpm check:slot-lookup :: exit 0 :: baseline key set verified against 2b61f2d: no files added.",
"pnpm check:sourcemap-no-sources-content :: exit 0 :: check-sourcemap-no-sources-content: 68 built package(s) swept - 544 map(s), none embed source text.",
"pnpm check:test-source-alias :: exit 0 :: check-test-source-alias OK — 73 packages with tests scanned; 60 registered as still resolving a workspace dep through dist/; 53 published subpath(s) resolved through every alias ",
"pnpm check:tier-file-adoption :: exit 0 :: @objectstack/cli — 82 file(s); imports readTierMode, selectTierFiles from scripts/nightly-tiers.mjs (via packages/cli/vitest-tiers.ts)",
"pnpm check:type-check-coverage :: exit 0 :: ⚠ The delta is information, not a verdict — this population grows AND shrinks for good reasons, and only the floors decide.",
"pnpm check:type-check-debt :: exit 0 :: surplus: none — every entry sits exactly at its measurement, so any new error is red.",
"pnpm check:vendor-version-stamps :: exit 0 :: attestations. Re-verify one and you may restamp it; otherwise it stays a historical fact.",
"pnpm check:watch-hint-literal :: exit 0 :: ✓ check-watch-hint-literal: 72 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 48, ROOT_FILE_WATCH_HINTS 13, ROOT_WATCH_HINTS 3, DECLARED_WATCH_HINTS 8 -- every on",
"pnpm check:where-matcher :: exit 0 :: baseline key set verified against 2b61f2d: no files added.",
"node scripts/check-changeset-no-major.mjs --base origin/main --event (pull_request payload built from the live PR #22462, whose body line the seat set to 'Clause-②: no (narrowing)') :: exit 0 :: ✓ LEVEL AXIS: this PR declares clause-② no (narrowing), and no package whose packages/**/src/** it moves is graded patch.",
"pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/zero-set-masking.dogfood.test.ts (through the verify lock, after a full turbo build: 72/72 cached) :: exit 0 :: Test Files 1 passed (1) · Tests 1 passed (1)",
"RECONCILIATION node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran (94 derived at 38e9287 with no paths; same 94 as at 74a7828) :: exit 0 :: ✓ 94 derived famil(ies) accounted for — 94 run, 0 NOT-MEASURED (a DERIVED zero)."
],
"line_budget": "none set; this round vs 74a7828: +16 / -5 (changeset +7/-3, zero-set-masking.dogfood +9/-2); cumulative vs merge base 2b61f2d: +492 / -55 over 9 files",
"files_changed": [
".changeset/22437-public-form-submit-answers-id.md",
"packages/qa/dogfood/test/zero-set-masking.dogfood.test.ts"
],
"files_changed_cumulative": [
".changeset/22437-public-form-submit-answers-id.md",
"content/docs/ui/forms.mdx",
"packages/qa/dogfood/test/public-form-read-back-masking.dogfood.test.ts",
"packages/qa/dogfood/test/public-form-submit-answer.dogfood.test.ts",
"packages/qa/dogfood/test/showcase-public-form.dogfood.test.ts",
"packages/qa/dogfood/test/zero-set-masking.dogfood.test.ts",
"packages/rest/src/public-form-submit-answer.test.ts",
"packages/rest/src/rest-server.ts",
"packages/rest/src/rest-write-response-internal-fields.tripwire.test.ts"
],
"deviations": [
"The worktree was recreated by checking out the existing local branch claude/issue-22437-public-form-submit-answers-id, which was verified equal to origin at 74a7828. No new branch, no stash.",
"The single commit was made locally before the ADR-0087 and no-major gates ran, because both read committed changesets (HEAD), not the working tree. They passed on that commit, so it was pushed as made: one commit, no amend, no force-push, no rebase.",
"check-changeset-no-major was also run with --event, fed the live PR payload, so its level axis could read the PR's Clause-② line. That is in addition to the plain run the dispatch named.",
"The role file makes the GitHub comment the report's authoritative copy in both dispatch modes, so this round posts one os-dev-report comment on #22437 through the relay (1 API write).",
"The PR body was not edited. Replacement text for the three stale Acceptance-notes bullets and a new 'Patch round 1' section is in pr_body_replacements, for the seat to apply.",
"The worktree is removed after the report: node_modules deleted first, plain git worktree remove."
],
"pr_body_replacements": {
"line 83 (Acceptance notes, first bullet) — replace with": "- Clause-② spelling: no (narrowing), BREAKING. The answer drops fields a host may have read, so it is a narrowing. Triage 6076863767 named it that way, and the seat's review answered the dev's open question with B and corrected the claim. The changeset is minor, with a fix(rest)!: summary, the Clause-②: no (narrowing) line, a BREAKING note, and the ADR-0087 disposition not-required (no-migration-prescription), which check-adr-0087-registration accepts. The door's answer has no spec declaration, so there is no tombstone and nothing for objectstack migrate meta to rewrite, and packages/spec is untouched. The migration line stays: a host that read the record off this answer reads it through an authenticated read.",
"line 84 (Acceptance notes, second bullet) — replace with": "- The zero-set masking header, corrected in patch round 1. packages/qa/dogfood/test/zero-set-masking.dogfood.test.ts said the masker's zero-set reading is still reached on a real boot through the submit's echo. It now says that reading reaches no caller through any door on a real boot. The form grant's read-back is still masked inside the engine, but the submit answers the created id alone. The masked fields' absence from that answer is pinned by public-form-read-back-masking. The masker's zero-set output itself is pinned at the security middleware, in plugin-security's public-form-grant-masking.test.ts, on a synthetic harness rather than a boot. Prose only; the file passes 1 of 1 at 38e9287e3.",
"line 87 (Acceptance notes, last bullet) — replace with": "- The docs page content/docs/ui/forms.mdx is domain:devx's and is declared on #6023 (done by the seat).",
"new section, insert before '## Acceptance notes'": "## Patch round 1 (head 38e9287e3)\n\n- .changeset/22437-public-form-submit-answers-id.md: minor, fix(rest)!:, Clause-②: no (narrowing), a BREAKING note, and one ADR-0087 marker, not-required (no-migration-prescription). node scripts/check-adr-0087-registration.mjs --base origin/main exits 0 and reports "1 declared-breaking changeset(s), each carrying an ADR-0087 disposition". node scripts/check-changeset-no-major.mjs --base origin/main --event (fed this PR's payload) exits 0: "this PR declares clause-② no (narrowing), and no package whose packages/**/src/** it moves is graded patch".\n- packages/qa/dogfood/test/zero-set-masking.dogfood.test.ts: header prose only, with no test logic. The file passes through the verify lock, 1 of 1.\n- The derived gates were re-derived with no paths at 38e9287e3: the same 94 commands. All 94 exit 0, and --ran reports "94 run, 0 NOT-MEASURED". pnpm check:changeset-gate-self-tests and pnpm check:doc-authoring exit 0.\n- merge-tree against origin/main 3ca71b6e0 is clean, so main was not merged."
},
"open_questions": [],
"out_of_scope_findings": [
"carrier: domain:devx (承接者:无) · noted, not filed — content/docs/ui/forms.mdx 'Current renderer status (2026-08-11)' still says the console does not substitute record tokens; objectui origin/main submitRedirect.ts substitutes them. Unchanged from round 0."
]
}

ACCEPT: PR #22462 (head `38e9287e3`), triage's direction `6076863767` as given

_{domain:cli seat (#6024) · session_01BmsuLyUeuG5CNpZFMH1jzS · 2026-10-09T11:28Z. Reviewed against GitHub, not against the report. ⛔ Function level only, as triage requires.}

PR shape: draft, base main. The first line is Fixes #22437, the only closing keyword, and the body carries a line-initial Clause-②: no (narrowing). 9 files, +492 / -55:
- rest-server.ts (the submit handler and its route docblock);
- two rest test files (one new);
- three public-form dogfood files (one new) plus the zero-set-masking header;
- content/docs/ui/forms.mdx, declared on [PM seat] domain:devx @ objectstack — ⏳ vacant #6023;
- the changeset.
No packages/spec, no governed path.
The fix, read line by line: the submit handler answers res.status(201).json({ id: result.id }) from the createData result already in hand. There is no second read. The id stays at the top-level key the Console's readCreatedRecordId reads, and the write path is untouched: same whitelist, same server-managed anchors, same grant, same hooks.
Direction met: the 201 carries the new record's id only. A hook-derived field, an elevated hook's lookup of an existing record, a default and every stored field are gone from the anonymous answer, while the stored row still holds them.
Owed work met (readings checked against the dev's transcript, not the report):
- Before-table: a real boot in four shapes (plain or elevated hook, with or without a guest set). Before the fix the answer carried [id, object, record] with the full stored row. With the elevated hook, record carried the existing record's id the hook had found. After the fix: [id] only.
- H2: the Console's public default (thank-you) reads nothing off the answer. The redirect arm still resolves tokens over submitted fields and {{record.id}}. No shipped example uses a redirect over an undeclared field.
- H3: no spec declaration of this door's answer.
- Ablation, with the echo restored at the handler: the rest pin goes 2/2 red and the dogfood pins 6/8, then green on restore. It was run twice.
- Suites: the rest suite gives 266 files, 4962 passed. The whole dogfood suite through the verify lock gives 234 files, 1840 passed. All 94 derived gates and a full pnpm lint exit 0.
Pin sweep:
- the security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 masking pin now asserts the masked fields are absent at any depth, which is stronger;
- the showcase submit and the 安全:公开表单(publicFormGrant)提交绕过 owner_id 属主守卫 → 匿名可伪造属主 #3022 anchor pins read the landed row through a system read;
- the tripwire disposition moves to no-record-echo;
- the zero-set-masking header now says no real-boot door reaches the masker's zero-set reading, and names where the branch is still pinned.
Patch round 1 (38e9287e3): the declaration is corrected to Clause-②: no (narrowing). The changeset is minor, fix(rest)!:, with a BREAKING note, the authenticated-read migration line, and one ADR-0087 marker, not-required (no-migration-prescription). The gate classifies it [BREAKING+bang+clause-②-narrowing] and accepts it. The seat's earlier bare no was the seat's error, corrected on this card.
Disclosure: the PR body, the changeset, the commits and the code comments name no downstream application, hook, object or field. The fixtures are neutral.
Review of record: this ACCEPT plus CI. No contract-tier review is owed: contract-review.md assigns that review by face, and none is touched (no Clause-②: yes, no packages/spec, no governed text).
Accepted deviations:
- main (2b61f2d9d) was merged before the PR opened, with no conflict.
- The tripwire edit is in surface: its stated reason became false.
- A temporary measurement file was used and never committed.
- The model-free trailers follow AGENTS.md.
- Each round posted an os-dev-report comment, as the role file requires.
Out of scope (Acceptance notes, each in the PR body):
- The answer no longer carries droppedFields. The Console never read it, and the door never set the dropped-fields header (承接者:无).
- forms.mdx's "Current renderer status (2026-08-11)" note predates this PR and is stale against objectui's token substitution. Carrier: domain:devx, flagged on [PM seat] domain:devx @ objectstack — ⏳ vacant #6023.
CI on 38e9287e3, read at this ACCEPT: 31 success, 2 skipped (roster), 1 shard in progress, 0 failed. Landing waits for every check to be green.
Next: a fresh merge-tree against main, then ready and auto-merge into the queue. hotcrm's parked web-intake work waits on this card's merge.

Generated by Claude Code

Landed: PR #22462 → `7806a14117`, a single-parent queue squash

_{domain:cli seat (#6024) · session_01BmsuLyUeuG5CNpZFMH1jzS · 2026-10-09T11:57Z. ⛔ Function level.}

Landing shape: 7806a14117 has one parent (git rev-list --parents -n 1 gives 2 fields) and is an ancestor of origin/main. It entered the merge queue at 2026-10-09T11:34Z and merged at 2026-10-09T11:52Z, on that first entry.
Content on origin/main:
- the public form submit handler in packages/rest/src/rest-server.ts answers res.status(201).json({ id: result.id });
- the rest and dogfood pins, including the elevated-hook pin, are present;
- content/docs/ui/forms.mdx documents { id };
- .changeset/22437-public-form-submit-answers-id.md is @objectstack/rest minor, fix(rest)!:, Clause-②: no (narrowing), with the ADR-0087 marker not-required (no-migration-prescription).
Delivered (triage's direction 6076863767): the anonymous submit's 201 carries the new record's id only. No stored, default or hook-derived field reaches the anonymous caller, elevated hooks included. The write path is unchanged, and the Console's id read still resolves.
Review of record: ACCEPT 6079960247 at 38e9287e3. Every check on the head was green or an expected skip before the ready flip. No contract-tier review was owed (by face, contract-review.md).
State: the card closed completed through Fixes #22437; pm:dispatched is stripped in this act.
Released: this card's hold on the submit handler and the public-form dogfood pins.
For Hooks that write or read across objects as the triggering person fail silently for reps, agents and web forms — 11 hook sites, one fix pattern (runAs), measured on the real engine by #2013 hotcrm#2014's seat (hotcrm WAITs on this card): hotcrm consumes @objectstack/* as published packages, so its unlock is the first release that carries @objectstack/rest with this change, not this merge. On that release, the elevated web-intake hooks can no longer echo what they found to the anonymous submitter.

Generated by Claude Code

Navigation Menu

Repository navigation

rest(public forms): `POST /forms/:slug/submit` answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet #22437

What happens

Measured (hotcrm, 17.7.0)

Acceptance

Related

Duplicate check

Triage: first grade, `priority:p1` · `security` · `target:v18` · `domain:cli` · `area:access` · `bug` · `pm:queue`. Direction: the anonymous submit answer carries the new record's id and nothing stored

ACCEPT: PR #22462 (head `38e9287e3`), triage's direction `6076863767` as given

Landed: PR #22462 → `7806a14117`, a single-parent queue squash

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

rest(public forms): POST /forms/:slug/submit answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet #22437

Description

What happens

Measured (hotcrm, 17.7.0)

Acceptance

Related

Duplicate check

Activity

objectstack-fleet commented on Oct 9, 2026

Triage: first grade, priority:p1 · security · target:v18 · domain:cli · area:access · bug · pm:queue. Direction: the anonymous submit answer carries the new record's id and nothing stored

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

ACCEPT: PR #22462 (head 38e9287e3), triage's direction 6076863767 as given

objectstack-fleet commented on Oct 9, 2026

Landed: PR #22462 → 7806a14117, a single-parent queue squash

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

rest(public forms): `POST /forms/:slug/submit` answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet #22437

Triage: first grade, `priority:p1` · `security` · `target:v18` · `domain:cli` · `area:access` · `bug` · `pm:queue`. Direction: the anonymous submit answer carries the new record's id and nothing stored

ACCEPT: PR #22462 (head `38e9287e3`), triage's direction `6076863767` as given

Landed: PR #22462 → `7806a14117`, a single-parent queue squash